SY0-701 Security Architecture Practice Question
An enterprise is moving from on-prem identity to a SaaS HR platform. Employees should sign in with corporate credentials, and terminated users must lose access quickly without manually creating or deleting SaaS passwords. Which solution best fits?
⚠ Common exam trap
A common mix-up: candidates confuse LDAP bind (Option B) with federated SSO, thinking that LDAP can directly authenticate against SaaS platforms, but LDAP is a directory access protocol that requires a gateway or federation service to work with cloud apps, and it lacks automated provisioning capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement federated SSO with the corporate identity provider and automated provisioning and deprovisioning.
Federated SSO with the corporate identity provider (IdP) allows employees to sign in using their existing corporate credentials via standards like SAML 2.0 or OIDC, eliminating the need for separate SaaS passwords. Automated provisioning and deprovisioning (e.g., via SCIM) ensures that when a user is terminated in the HR platform, their access to the SaaS application is revoked immediately without manual intervention, meeting the requirement for rapid access removal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a shared HR password for all employees and change it quarterly.
Why it's wrong here
A shared HR password creates a single credential that cannot be attributed to individual users, destroying accountability and non-repudiation for security investigations. Even with quarterly rotation, the password remains publicly known across the workforce, and any former employee or compromised insider could retain access. This approach completely eschews identity lifecycle management, making it impossible to automatically revoke access when someone departs.
- ✗
Use LDAP bind accounts directly against the SaaS platform for every login.
Why it's wrong here
Direct LDAP bind accounts are rarely supported by SaaS platforms since they live outside the corporate network and require secure LDAP exposure over the internet, which is both a security risk and an administrative burden. Moreover, LDAP binds transmit credentials in a manner that lacks modern federated identity context like SAML assertions or OIDC tokens, so it cannot integrate with conditional access policies or multi-factor authentication. It also does not provide automated provisioning or deprovisioning, leaving access stale after employees change roles.
- ✓
Implement federated SSO with the corporate identity provider and automated provisioning and deprovisioning.
Why this is correct
Federated SSO delegates authentication to the corporate identity provider, allowing users to sign in with existing enterprise credentials via standards like SAML or OIDC, while eliminating the need for separate SaaS passwords. Coupled with SCIM-based automated provisioning and deprovisioning, the platform's user accounts are created, updated, and removed synchronously with HR records, ensuring that departing employees lose access immediately. This architectural pattern enhances security, simplifies compliance, and reduces identity sprawl.
- ✗
Require each user to create a separate local SaaS account and store the credentials in a vault.
Why it's wrong here
Creating individual local accounts for SaaS forces users to manage another set of credentials, and storing them in a vault does not reduce the risk of credential phishing or password reuse. More critically, deprovisioning becomes manual and error-prone, as administrators must remember to remove each local account when employees leave, potentially leaving orphaned access. Unlike federated identity, a vault does not provide integrated single sign-on or support modern authentication protocols, so the solution fails to meet the requirement for streamlined identity lifecycle management.
Go deeper
Related to this question
Learn chapter
Web Application Firewall (WAF)
Key term
Provisioning
Provisioning is the process of setting up and configuring IT resources, such as user accounts, devices, or network services, so they are ready for use.
Key term
SSO
Single Sign-On (SSO) is an authentication process that allows a user to access multiple applications or systems with one set of login credentials.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An HR system marks employees as hired, transferred, or terminated. The security team wants those changes to create, update, or disable accounts in multiple SaaS apps automatically after the user authenticates through the company identity provider. Which capability should be added?
medium- A.SAML federation alone, with no additional account lifecycle automation.
- B.Password synchronization between every application.
- ✓ C.SCIM provisioning integrated with the SSO platform.
- D.Local administrator groups on each SaaS application.
Why C: SCIM (System for Cross-domain Identity Management) is the correct choice because it provides a standardized protocol for automating the creation, update, and deletion of user accounts across multiple SaaS applications. When integrated with an SSO platform (like SAML), SCIM handles the lifecycle events (hire, transfer, terminate) by sending RESTful API calls to each SaaS app, ensuring accounts are created, updated, or disabled without manual intervention. SAML alone only handles authentication, not account provisioning, making SCIM essential for the described automation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.